Executive brief
Twisted, a popular Python networking engine, contains a flaw in its DNS handling module. An attacker can send a specially crafted DNS request that causes the server to become unresponsive while trying to process complex data structures. This results in a denial-of-service, preventing the server from handling any other legitimate network traffic or requests.
Technical details
The vulnerability exists in the twisted.names.dns.Name.decode function due to inefficient algorithmic complexity when handling DNS compression pointers. While the module contains logic to prevent infinite loops, it lacks a limit on the total number of pointer dereferences allowed per message. Additionally, the 'visited' set used for loop detection is reset for each Question record. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet with thousands of questions pointing to a deep chain of compression pointers, causing the single-threaded Twisted reactor to hang during decompression. This issue is addressed in version 26.4.0rc2.
Affected products
- Twisted Matrix Labs Twisted <= 25.5.0
Timeline
- 2026-04-18: disclosed: Initial disclosure date according to researcher profile
- 2026-04-29: advisory: GitHub Advisory published
- 2026-05-13: advisory: NVD published CVE-2026-42304
References
- https://api.github.com/users/tomasilluminati
- https://github.com/tomasilluminati
- https://api.github.com/users/tomasilluminati/gists%7B/gist_id%7D
- https://api.github.com/users/tomasilluminati/repos
- https://avatars.githubusercontent.com/u/147225560?v=4
- https://api.github.com/users/tomasilluminati/events%7B/privacy%7D